Security & Compliance
Six controls a CISO signs off on. Before pilot.
AscendCore was architected for CISOs and CIOs, not just help-desk managers. Every action waits for an explicit human approval, every credential lives in its own logical vault, and every execution appends to a SHA-256 audit chain.
100%
Actions require an explicit human approval. No exceptions, no autopilot mode.
Architecture ledger
06 controls
Logical vault, per org
Per-Organization Isolation
Human approval · 100% HITL
Approval-First Execution
SHA-256 hash chain
Tamper-Evident Audit Chain
HMAC-SHA256 · JWT
Verified Webhook Integrity
Server-enforced · Entra ID
RBAC + Identity
TLS 1.2+ · AES-256
Encryption In Transit & At Rest
The proof
One chain. Every decision. Provable.
Every approve, deny, and execution appends to a tamper-evident SHA-256 chain backed by Postgres. Each record's hash includes the prior record's hash. Export it as CSV, re-hash it from genesis, and check it offline. The proof is the customer's, not ours.
SOC 2 Type I is planned. This export is evidence you can hand an auditor, not a compliance certification.
GOVERNANCE · AUDIT CHAIN
✓ chain re-computed from genesis. every value matched.
simulated preview, real grammar · the live chain is verifiable in the demo
Security posture · Verifiable
Verifiable today. Roadmap disclosed.
The controls a CISO will ask about, split honestly: what's enforced in production right now, and what's on the audit calendar.
Live in production today
EnforcedLogical vault, per org
Per-Organization Isolation
Each org's integration secrets (Okta, Entra, M365, Slack) are scoped to that org: customer-entered credentials are sealed with AES-256-GCM in a per-org vault, and platform secrets are managed in Doppler. Credentials resolve only for that org's traffic, namespaced across the audit chain and operational store.
EnforcedHuman approval · 100% HITL
Approval-First Execution
Every runbook stops at an explicit human sign-off before it touches production. No autonomous actions. Idempotent retries prevent double-execution under network failure or a double-tap.
EnforcedSHA-256 hash chain
Tamper-Evident Audit Chain
Every approve, deny, and execution appends to a SHA-256 hash chain. Each row links to the prior row's hash, so a single altered row breaks verification. Customer-exportable for independent proof.
See it in the demo (sample data)
EnforcedHMAC-SHA256 · JWT
Verified Webhook Integrity
Inbound Slack requests are verified via HMAC-SHA256 with timing-safe comparison; inbound Teams activities via JWT against Microsoft's public JWKS. Spoofed requests are rejected at the edge.
EnforcedServer-enforced · Entra ID
RBAC + Identity
Roles are enforced server-side: administrator and approver in your portal, and on AscendCore's console demo and guest roles are refused on every mutation. Approvals in Teams run under your users' own Microsoft 365 sign-in, so your Entra ID MFA and Conditional Access policies apply.
EnforcedTLS 1.2+ · AES-256
Encryption In Transit & At Rest
TLS 1.2 and 1.3 in transit at the Netlify edge, with older versions refused and HSTS on. At rest, Neon and Cloudflare R2 encrypt with AES-256 and Netlify encrypts Blobs; integration credentials are sealed a second time with AES-256-GCM.
On the roadmap
SOC-2 Type I
PlannedNot yet enrolled. Enrollment begins once budgeted, followed by a ~90-day audit window and then certification.
Independent penetration test
PlannedThird-party assessment. Report shared under NDA for active procurement conversations once complete.
SOC-2 Type II
PlannedFollows Type I plus an observation period.
ISO 27001
PlannedPost-SOC-2 alignment for international procurement. Not yet mapped or certified.
Customer-managed keys (BYOK)
PlannedBring-your-own-KMS for application-level data encryption.
Security cleared? See what a pilot looks like.
Items move from roadmap to live via dated commits and changelog entries. For status against a specific control, email security@ascendcore.ai.
Sub-processors
The third-party services that may process customer data while delivering AscendCore, used under each provider's standard terms and published data processing terms. Under our DPA (Section 7), customers get at least 14 days' notice before a sub-processor is added or replaced. Teams messages reach AscendCore through Microsoft's Bot Framework service; Microsoft 365, Okta, Slack, and your ITSM are your own systems, called through the connection you approve.
| Vendor | Purpose | Region | Notes |
|---|---|---|---|
| Netlify | Application hosting, serverless functions, Blobs operational store | US | Blobs store in US East 2 |
| Neon | Postgres database (audit chain, credential vault) | US East 2 | Postgres 17 on AWS |
| Cloudflare R2 | Object storage for exports and uploads (AES-256) | Not pinned | Automatic location |
| Doppler | AscendCore platform secrets, including the vault key | US | Holds no customer-entered credentials |
| Anthropic | LLM inference (request classification, optional IT help assistant) | US | No training on customer content (Commercial Terms) |
| Resend | Transactional email (notifications) | US | Notifications can name the target user and action |
| Sentry | Application error tracking | US | Configured not to send default personal data |
| PostHog | Product analytics (page views) | US | Only after cookie consent |
Questions we get from security teams.
Honest answers, including for the things we're still building.
Want to verify any specific control?
We'll do a technical review call, walk through architecture in detail, share our internal audit findings under NDA, or answer specific items on your enterprise security questionnaire.
Ready to take L1 off your queue?
AscendCore is onboarding private-beta pilots now. Onboarding takes days, not months, with human-in-the-loop approval on every action.
No credit card required. 30-day pilot. Cancel anytime.
